win: Crash destroying parent window while modal alert is visible

[EricPRHC]

Description
When an alert is rendered, and the dispose is called on the browser, my WPF application crashes instantly.

To Reproduce
Steps to prepare

1. Starting point can be the CefSharp minimal example
2. Add a button and buttonhandler that calls the dispose on the browser

Steps to reproduce the behavior:

1. Type in the address bar javascript:alert() and hit enter
2. Click the newly added button which calls Dispose
3. Notice that the application shuts down
   Expected behavior
   Not to crash at least; handle gracefully; probably you'll have an idea on either to prevent disposing or close the alert upon disposing, or so.

Screenshots
Example button

**Versions

• OS: Windows 11
• CEF Version:
• • minimal example v144.0.120.0
• • also fails in v145.0.260.0 (x86, 4.8) in our own application
• • also fails in 140.1.140 in our own application

Additional context
Does the problem reproduce with the cefclient or cefsimple sample application at the same version?
CefSharp.MinimalExample.Wpf

Does the problem reproduce with Google Chrome at the same version?
Cannot reproduce, I cannot call Dispose() on Google Chrome

Callstack

[Inline Frame] libcef.dll!base::ScopedObservationTraits<skills::SkillsService,skills::SkillsService::Observer>::RemoveObserver(skills::SkillsService * source, skills::SkillsService::Observer * observer) Line 74	C++
 	libcef.dll!base::ScopedObservation<skills::SkillsService,skills::SkillsService::Observer>::Reset() Line 115	C++
 	libcef.dll!base::ScopedObservation<skills::SkillsService,skills::SkillsService::Observer>::~ScopedObservation() Line 101	C++
 	[Inline Frame] libcef.dll!constrained_window::`anonymous namespace'::ModalDialogHostObserverViews::~ModalDialogHostObserverViews() Line 73	C++
 	libcef.dll!constrained_window::`anonymous namespace'::ModalDialogHostObserverViews::~ModalDialogHostObserverViews() Line 73	C++
 	[Inline Frame] libcef.dll!std::__Cr::default_delete<media::VideoDecoder>::operator()(media::VideoDecoder * __ptr) Line 74	C++
 	[Inline Frame] libcef.dll!std::__Cr::unique_ptr<media::VideoDecoder,std::__Cr::default_delete<media::VideoDecoder>>::reset(media::VideoDecoder * __p) Line 288	C++
 	[Inline Frame] libcef.dll!std::__Cr::unique_ptr<media::VideoDecoder,std::__Cr::default_delete<media::VideoDecoder>>::~unique_ptr() Line 254	C++
 	libcef.dll!base::DeleteUniquePtrHelper<media::VideoDecoder>::DoDelete(const void * object) Line 40	C++
 	[Inline Frame] libcef.dll!ui::PropertyHandler::ClearProperties::<lambda_0>::operator()(ui::PropertyHandler::Value & v) Line 53	C++
 	[Inline Frame] libcef.dll!std::__Cr::__invoke(ui::PropertyHandler::ClearProperties::<lambda_0> & __args, ui::PropertyHandler::Value & __args) Line 90	C++
 	libcef.dll!std::__Cr::__tree_iterate_from_root<std::__Cr::pair<const void *const,ui::PropertyHandler::Value> &,`lambda at ..\..\third_party\libc++\src\include\__tree:1545:11',std::__Cr::__tree_node<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,void *> *,`lambda at ..\..\ui\base\class_property.cc:51:35',ui::PropertyHandler::Value std::__Cr::pair<const void *const,ui::PropertyHandler::Value>::*>(std::__Cr::__specialized_algorithm<std::__Cr::_Algorithm::__for_each,std::__Cr::__single_range<std::__Cr::__tree<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,std::__Cr::__map_value_compare<const void *,std::__Cr::pair<const void *const,ui::PropertyHandler::Value>,std::__Cr::less<const void *>>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>>>>::operator()<std::__Cr::__tree<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,std::__Cr::__map_value_compare<const void *,std::__Cr::pair<const void *const,ui::PropertyHandler::Value>,std::__Cr::less<const void *>>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>> &,`lambda at ..\..\ui\base\class_property.cc:51:35',ui::PropertyHandler::Value std::__Cr::pair<const void *const,ui::PropertyHandler::Value>::*>::void <lambda>(base::OnceCallback<mojo::StructPtr<unexportable_keys::mojom::UnexportableKeyService_GenerateSigningKey_ResponseParam_Result> (base::expected<mojo::StructPtr<unexportable_keys::mojom::NewKeyData>,unexportable_keys::ServiceError>)>, base::OnceCallback<void (mojo::StructPtr<unexportable_keys::mojom::UnexportableKeyService_GenerateSigningKey_ResponseParam_Result>)>, base::expected<mojo::StructPtr<unexportable_keys::mojom::NewKeyData>,unexportable_keys::ServiceError>) __root, std::__Cr::__tree_node<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,void *> * __func, ui::PropertyHandler::ClearProperties::<lambda_0> & __proj, ui::PropertyHandler::Value * &) Line 673	C++
 	[Inline Frame] libcef.dll!std::__Cr::__specialized_algorithm<std::__Cr::_Algorithm::__for_each,std::__Cr::__single_range<std::__Cr::__tree<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,std::__Cr::__map_value_compare<const void *,std::__Cr::pair<const void *const,ui::PropertyHandler::Value>,std::__Cr::less<const void *>>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>>>>::operator()(std::__Cr::__tree<std::__Cr::__value_type<const void *,ui::PropertyHandler::Value>,std::__Cr::__map_value_compare<const void *,std::__Cr::pair<const void *const,ui::PropertyHandler::Value>,std::__Cr::less<const void *>>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>> & __range, ui::PropertyHandler::ClearProperties::<lambda_0> __func, ui::PropertyHandler::Value * __proj) Line 1544	C++
 	[Inline Frame] libcef.dll!std::__Cr::__specialized_algorithm<std::__Cr::_Algorithm::__for_each,std::__Cr::__single_range<std::__Cr::map<const void *,ui::PropertyHandler::Value,std::__Cr::less<const void *>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>>>>::operator()(std::__Cr::map<const void *,ui::PropertyHandler::Value,std::__Cr::less<const void *>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>> & __map, ui::PropertyHandler::ClearProperties::<lambda_0> __func, ui::PropertyHandler::Value * __proj) Line 1491	C++
 	[Inline Frame] libcef.dll!std::__Cr::ranges::__for_each::operator()(std::__Cr::map<const void *,ui::PropertyHandler::Value,std::__Cr::less<const void *>,std::__Cr::allocator<std::__Cr::pair<const void *const,ui::PropertyHandler::Value>>> & __range, ui::PropertyHandler::ClearProperties::<lambda_0> __func, ui::PropertyHandler::Value * __proj) Line 78	C++
 	[Inline Frame] libcef.dll!ui::PropertyHandler::ClearProperties() Line 56	C++
 	libcef.dll!ui::PropertyHandler::~PropertyHandler() Line 24	C++
 	libcef.dll!views::Widget::~Widget() Line 299	C++
 	libcef.dll!views::`anonymous namespace'::DialogWidget::~DialogWidget() Line 50	C++
 	[Inline Frame] libcef.dll!std::__Cr::default_delete<views::internal::NativeWidgetDelegate>::operator()(views::internal::NativeWidgetDelegate * __ptr) Line 74	C++
 	[Inline Frame] libcef.dll!std::__Cr::unique_ptr<views::internal::NativeWidgetDelegate,std::__Cr::default_delete<views::internal::NativeWidgetDelegate>>::reset(views::internal::NativeWidgetDelegate * __p) Line 288	C++
 	libcef.dll!views::DesktopNativeWidgetAura::~DesktopNativeWidgetAura() Line 316	C++
 	libcef.dll!views::DesktopNativeWidgetAura::~DesktopNativeWidgetAura() Line 309	C++
 	libcef.dll!views::DesktopNativeWidgetAura::OnHostClosed() Line 396	C++
 	libcef.dll!views::HWNDMessageHandler::OnWndProc(unsigned int message, unsigned int w_param, long l_param) Line 1214	C++
 	libcef.dll!gfx::WindowImpl::WndProc(HWND__ * hwnd, unsigned int message, unsigned int w_param, long l_param) Line 312	C++
 	libcef.dll!base::win::WrappedWindowProc<&gfx::WindowImpl::WndProc>(HWND__ * hwnd, unsigned int message, unsigned int wparam, long lparam) Line 74	C++
 	[External Code]	
 	[Frames below may be incorrect and/or missing, no symbols loaded for USER32.dll]	
 	[Inline Frame] libcef.dll!base::OnceCallback<void ()>::Run() Line 155	C++
 	libcef.dll!base::TaskAnnotator::RunTaskImpl(base::PendingTask & pending_task) Line 229	C++
 	[Inline Frame] libcef.dll!base::TaskAnnotator::RunTask(perfetto::StaticString event_name, base::PendingTask & pending_task, base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl::<lambda_4> && args) Line 112	C++
 	[Inline Frame] libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow * continuation_lazy_now) Line 472	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() Line 346	C++
 	libcef.dll!base::MessagePumpForUI::DoRunLoop() Line 261	C++
 	libcef.dll!base::MessagePumpWin::Run(base::MessagePump::Delegate * delegate) Line 89	C++
 	libcef.dll!base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool application_tasks_allowed, base::TimeDelta timeout) Line 650	C++
 	libcef.dll!base::RunLoop::Run(const base::Location & location) Line 137	C++
 	libcef.dll!CefMainRunner::RunMessageLoop() Line 156	C++
 	libcef.dll!CefUIThread::ThreadMain() Line 105	C++
 	libcef.dll!base::`anonymous namespace'::ThreadFunc(void * params) Line 105	C++
 	[External Code]	

Known Workarounds
Custom JSDialogHandler that shows a WPF MessageBox and custom Window for a Prompt.

Reference
Reference by amaitland: #4026

I had originally posted this at cefsharp/CefSharp#5226

[magreenblatt]

Are you able to reproduce this crash with the CEF Sample Application? If so, what command-line flags are necessary to reproduce the crash?

[EricPRHC]

Are you able to reproduce this crash with the CEF Sample Application? If so, what command-line flags are necessary to reproduce the crash?

I couldn't tell you how since I dont know how to invoke a Dispose() in a running (what seems to me) Winforms application; in a WPF application I would probably be able to reproduce it using Snoop (WPF inspector).

[magreenblatt]

It looks like you're destroying the parent window while the alert is still visible. This should generally not be possible as the alert dialog should be modal to the parent window.